Update — solved! The issue was the FCM message format, not the token/key/config.
A data-only FCM message is never displayed by iOS when the app is killed. I confirmed this by sending a direct FCM v1 message to the device token with a notification block + an apns override (apns.payload.aps.alert) — it displays perfectly.
So the FCM token, APNs Auth Key, Firebase config and capability were all correct the whole time. The fix was simply to include a notification / apns payload instead of sending data-only.
Thanks for the tip to check the FCM response — the HTTP 200 (no THIRD_PARTY_AUTH_ERROR / UNREGISTERED) is exactly what confirmed the delivery path was fine and isolated it to the payload. Posting the resolution in case it helps others. 🙏
Topic:
App & System Services
SubTopic:
Notifications